The Conservatives are calling for a full inquiry after it emerged a laptop containing details on 3,000 patients has been stolen from a GPs' surgery.
The machine has patients' names, addresses, dates of birth, phone numbers and a link to a picture of their retinas, and was taken from the surgery in Newport, South Wales.
But it does not contain any national insurance numbers or medical information.
Cardiff and Vale NHS Trust chief executive Hugh Ross said 950 patients have definitely been affected by the incident, and he is now writing to them to explain the situation.
He said: "It is possible that further patient records, which were due to be deleted, may still be stored on the computer.
"The trust has no way of knowing if this is the case unless the laptop can be recovered.
"I would like to offer a sincere apology to all patients affected by this theft and reassure them that there are very strong security measures on all our IT systems to prevent confidential information being accessed.
"This is an isolated incident and we are taking immediate action to try and ensure that it does not happen again."
But the Welsh Conservatives' shadow health minister Jonathan Morgan said: "It is yet another disturbing development which will further undermine public confidence in measures to protect sensitive information."